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Abstract 

Some quantum cryptographic protocols can be implemented with specially prepared 
chocolate balls, others protected by value indefiniteness cannot. Similarities and differ- 
ences of cryptography with quanta and chocolate are discussed. Motivated by these con- 
siderations it is proposed to certify quantum random number generators and quantum cryp- 
tographic protocols by value indefiniteness. This feature, which derives itself from Bell- 
and Kochen-Specker type arguments, is only present in systems with three or more mutu- 
ally exclusive outcomes. 
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I. QUANTUM RESOURCES FOR CRYPTOGRAPHY 



Quantum cryptography^ uses quantum resources to encode plain symbols forming some mes- 
sage. Thereby, the security of the code against cryptanalytic attacks to recover that message rests 
upon the validity of physics, giving new and direct meaning to Landauer's dictum [6] "information 
is physical." 

What exactly are those quantum resources on which quantum cryptography is based upon? 
Consider, for a start, the following qualities of quantized systems: 

(i) randomness of certain individual events, such as the occurrence of certain measurement 
outcomes for states which are in a superposition of eigenstates associated with eigenvalues 
corresponding to these outcomes; 

(ii) complementarity, as proposed by Pauli, Heisenberg and Bohr; 

(iii) value indefiniteness, as attested by Bell, Kochen & Specker and others (often, this property 
is referred to as "contextuality"); 

(iv) interference and quantum parallelism, allowing the co-representation of classically contra- 
dicting states of information by a coherent superposition thereof; 

(v) entanglement of two or more particles, as pointed out by Schrodinger, such that their state 
cannot be represented as the product of states of the isolated, individual quanta, but is rather 
defined by the joint or relative properties of the quanta involved. 

The first quantum cryptographic protocols, such as the ones by Wiesner [7] and Bennett & 
Brassard [8, 9], just require complementarity and random individual outcomes. This might be 
perceived ambivalently as and advantage — by being based upon only these two features — yet 
also as a disadvantage, since they are not "protected" by Bell- or Kochen- Specker type value 
indefiniteness. 

This article addresses two issues: a critical re-evaluation of quantum cryptographic protocols 
in view of quantum value indefiniteness; as well as suggestions to improve them to assure the best 

' In view of the many superb presentations of quantum cryptography — to name but a few, see Refs. [1,2] and 
|3, Chapter 6] (or, alternatively, [4, Section 6.2]), as well as [5, Section 12.6]; apologies to other authors for this 
incomplete, subjective collection — we refrain from any extensive introduction. 
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possible protection "our" [10, p. 866] present quantum theory can afford. In doing so, a toy model 
will be introduced which implements complementarity but still is value definite. Then it will be 
exemplified how to do perform "quasi-classical" quantum-like cryptography with these models. 
Finally, methods will be discussed which go beyond the quasi-classical realm. 

Even nowadays it is seldom acknowledged that, when it comes to value definiteness, there defi- 
nitely is a difference between two- and three-dimensional Hilbert space. This difference can prob- 
ably be best explained in terms of (conjugate) bases: whereas different basis in two-dimensional 
Hilbert space are disjoint and separated (they merely share the trivial origin), from three dimen- 
sions onwards, they may share common elements. It is this inter-connectedness of bases and 
"frames" which supports both Gleason's and the Kochen-Specker theorem. This can, for instance, 
be used in derivations of the latter one in three dimensions, which effectively amount to a suc- 
cession of rotations of bases along one of their elements (the original Kochen-Specker [11] proof 
uses 117 interlinked bases), thereby creating new rotated bases, until the original base is reached. 
Note that certain (even dense [12]) "dilutions" of bases break up the possibility to interconnect, 
thus allowing value definiteness. 

The importance of these arguments for physics is this: since in quantum mechanics the dimen- 
sion of Hilbert space is determined by the number of mutually exclusive outcomes, a necessary 
condition for a quantum system to be protected by value indefiniteness thus is that the associated 
quantum system has at least three mutually exclusive outcomes; two outcomes are insufficient for 
this purpose. Of course, one could argue that systems with two outcomes are still protected by 
complementarity. 

II. REALIZATIONS OF QUANTUM CRYPTOGRAPHIC PROTOCOLS 

Let us, for the sake of demonstration, discuss a concrete "toy" system which features com- 
plementarity but (not) value (in)definiteness. It is based on the partitions of a set. Suppose the 
set is given by S = {1,2,3,4}, and consider two of its equipartitions A = {{1,2}, {3, 4}} and 
B = {{1,3}, {2,4}}, as well as the usual set theoretic operations (intersection, union and comple- 
ment) and the subset relation among the elements of these two partitions. Then A and B generate 
two Boolean algebras La = (0, {1,2}, (3, 4), 5} and Lg = (0, {1,3}, (2, 4), 5} which are equiva- 
lent to 2^; with two atoms ai = {1,2} & 02 = {3,4}, as well as Z^i = {1,3} & = {2,4} per alge- 
bra, respectively. Then, the partition logic LaOLb = La,b = { {La )^fi})n,U,',c)is obtained as a 
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FIG. 1 (a) Greechie diagram of La^b, consisting of two separate Boolean subalgebras La and Lb; (b) two- 
dimensional configuration of spin-^ state measurements along two noncollinear directions. As there are 
only two mutually exclusive outcomes, the dimension of the Hilbert space is two. 

pasting construction from La and Lg: only elements contribute which are in La, or in Lg, or in both 
LaHLb of them (the atoms of this algebra being the elements ai , . . . , b2), and all common elements 
— in this case only the smallest and greatest elements and S — are identified. g "inherits" the 
operations and relations of its subalgebras (also called blocks or contexts) La and Lg. This past- 
ing construction yields a nondistributive and thus nonboolean, orthocomplemented propositional 
structure. Nondistributivity can quite easily be proven, as ai A {bi VZ?2) 7^ («i Abi) V (ai AZ72), 
since bi\/b2 = S, whereas ai Abi = ai Ab2 = Note that, although ai , . . . ,Z72 are compositions of 
elements of S, not all elements of the power set 2'^ = 2"^ of S, such as { 1 } or { 1 , 2, 3}, are contained 
in La,b- 

Figure 1(a) depicts a Greechie (orthogonality) diagram of La,b, which represents elements in 
a Boolean algebra as single smooth curves; in this case there are just two atoms (least elements 
above 0) per subalgebra; and both subalgebras are not interconnected. 

Several realizations of this partition logic exist; among them 

(i) the propositional structure [13, 14] of spin state measurements of a spin-^ particle along two 
noncollinear directions, or of the linear polarization of a photon along two nonorthogonal, 
noncollinear directions. A two-dimensional Hilbert space representation of this configura- 
tion is depicted in Figure 1(b). Thereby, the choice of the measurement direction decides 
which one of the two complementary spin state observables is measured; 

(ii) generalized urn models [15, 16]; in particular ones with black balls painted with two sym- 
bols having two possible values (say, "0 and "1) in two colors (say, "red" and "green"), 
resulting in four types of balls — more explicitly, carrying all variation of the symbols 
^fc. as well as — many copies of which are randomly distributed in an urn. Sup- 
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pose the experimenter looks at them with one of two differently colored eyeglasses, each 
one ideally matching the colors of only one of the symbols, such that only light in this wave 
length passes through. Thereby, the choice of the color decides which one of the two com- 
plementary observables associated with "red" and "green" is measured. Propositions refers 
to the possible ball types drawn from the urn, given the information printed in the chosen 
color. 

(iii) initial state identification problem for deterministic finite (Moore or Mealy) automata in 
an unknown initial state [17, 18]; in particular ones (5,/, 0,5,?i) with four internal states 
S = {1,2,3,4}, two input and two output states / = O = {0, 1}, an "irreversible" (all-to- 
one) transition function d{s,i) = 1 for all s E S, i E I, and an output function "modelling" 
the state partitions by ?i(l,0) = ?i(2,0) = 0, 1(3,0) = X(4,0) = 1, 1(1,1) = 1(3, 1) = 0, 
X(2, 1) = X(4, 1) = 1. Thereby, the choice of the input symbol decides which one of the two 
complementary observables is measured. 

Let us, for the moment, consider generalized urn models, because they allow a "pleasant" 
representation as chocolate balls coated in black foils and painted with color symbols. With the 
four types of chocolate balls and drawn from an urn it is possible to execute 

the 1984 Bennett-Brassard (BB84) protocol [8, 9] and "generate" a secret key shared by two 
parties [19]. Formally, this reflects (i) the random draw of balls from an urn, as well as (ii) the 
complementarity modeled via the color painting and the colored eyeglasses. It also reflects the 
possibility to embed this model into a bigger Boolean (and thus classical) algebra 2^ by "taking 
off the eyeglasses" and looking at both symbols of those four balls types simultaneously. The 
atoms of this Boolean algebra are just the ball types, associated with the four cases ^fc. 
and ^1. The possibility of a classical embedding is also reflected in a "sufficient" number (i.e., 
by a separating, full set) of two-valued, dispersionless states P(ai) +P(a2) = P(b\) +P(b2) = 1, 
with P(x) E {0, 1}. These two-valued states can also be interpreted as logical truth assignments, 
irrespective of whether or not the observables have been (co-)measured. 

The possibility to ascribe certain "ontic states" interpretable as observer-independent "omni- 
scient elements of physical reality" (in the sense of Einstein, Podolsky and Rosen [20, p. 777], 
a paper which amazingly contains not a single reference) even for complementarity observables 
may raise some skepticism or even outright rejection, since that is not how quantum mechanics 
is known to perform "at its most mind-boggling mode." Indeed, so far, the rant presented merely 
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attempted to convince the reader that one can have complementarity as well as value definite- 
ness; i.e., complementarity is not sufficient for value indefiniteness in the sense of the Bell- and 
Kochen-Specker argument. 

Unfortunately, the two-dimensionality of the associated Hilbert space is also a feature plaguing 
present random number generators based on beam splitters [21-24]. In this respect, most of the 
present random number generators using beam splitters are protected only by the randomness 
of single outcomes as well as by complementarity, but are not by certified value indefiniteness, 
as guaranteed by quantum theory in its standard form [25]. Their methodology should also be 
improved by the methods discussed below. 

III. SUPPORTING CRYPTOGRAPHY WITH VALUE INDEFINITENESS 

Alas, quantum mechanics is more resourceful and mind-boggling than that, as it does not permit 
any two-valued states which may be ontologically interpretable as elements of physical reality. So 
we have to go further, reminding ourselves that value indefiniteness comes about only for Hilbert 
spaces of dimensions three and higher. There are several ways of doing this. The following options 
will be discussed: 

(i) the known protocols can be generalized to three or more outcomes; 

(ii) entangled pairs of particles [26] associated with statistical value indefiniteness may be con- 
sidered; 

(iii) full, nonprobabilistic value indefiniteness may be attempted, alt least counterfactually. 
A. Generalizations to three and more outcomes 

In constructing quantum random number generators via beam splitters which ultimately are 
used in cryptographic setups, it is important (i) to have full control of the particle source, and (ii) 
to use beam splitters with three or more output ports, associated with three- or higher-dimensional 
Hilbert spaces. Thereby, it is not sufficient to compose a multiport beam splitter by a succession 
of phase shifters and beam splitters with two output ports [27, 28], based on elementary decom- 
positions of the unitary group [29]. 
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Dichotomic sequences could be obtained from sequences containing more than two symbols 
by discarding all other symbols from that sequence [30], or by identifying the additional symbols 
with one (or both) of the two symbols. For standard normalization procedures and their issues, the 
reader is referred to Refs. [31-35]. 

One concrete realization would be a spin-| particle. Suppose it is prepared in one of its four 
spin states, say the one associated with angular momentum +|^ in some arbitrary but definite 
direction; e.g., by a Stem-Gerlach device. Then, its spin state is again measured along a perpen- 
dicular direction; e.g., by another, differently oriented, Stem-Gerlach device. Two of the output 
ports, say the ones corresponding to positive angular momentum and +^h, are identified 
with the symbol "0," the other two ports with the symbol "1." In that way, a random sequence is 
obtained from quantum coin tosses which can be ensured to operate under the conditions of value 
indefiniteness in the sense of the Kochen-Specker theorem. Of course, this protocol can also be 
used to generate random sequences containing four symbols (one symbol per detector). 

With respect to the use of beam splitters, the reader is kindly reminded of another issue related 
to the fact that beam splitters are reversible devices capable of only translating an incoming signal 
into an outgoing signal in a one-to-one manner. The "nondestructive" action of a beam splitter 
could also be demonstrated by "reconstructing" the original signal through a "reversed" identical 
beam splitter in a Mach-Zehnder interferometer [36]. In this sense, the signal leaving the output 
ports of a beam splitter is "as good" for cryptographic purposes as the one entering the device. This 
fact relegates considerations of the quality of quantum randomness to the quality of the source. 
Every care should thus be taken in preparing the source to assure that the state entering the input 
port (i) either is pure and could subsequently be used for measurements corresponding to conjugate 
bases, (ii) or is maximally mixed, resulting in a representation of its state in finite dimensions 
proportional to the unit matrix. 

B. Configurations with statistical value indefiniteness 

Protocols like the Ekert protocol [26] utilize two entangled two-state particles for a generation 
of a random key shared by two parties. The particular Einstein-Podolsky-Rosen configuration [20] 

and the singlet Bell state communicated among the parties guarantee stronger- than-classical cor- 
relations of their sequences, resulting in a violation of Bell-type inequalities obeyed by classical 
probabilities. 
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Although criticized [37] on the grounds that the Ekert protocol in certain cryptanalytic aspects 
is equivalent to existing ones (see Ref. [38] for a reconciliation), it offers additional security in 
the light of quantum value indefiniteness, as it suggests to probe the nonclassical parts of quantum 
statistics. This can best be understood in terms of the impossibility to generate co-existing tables 
of all — even the counterfactually possible — measurement outcomes of the quantum observables 
used [39]. This, of course, can only happen for the four-dimensional Hilbert space configuration 
proposed by Ekert, and not for effectively two-dimensional ones of previous proposals. As a 
result, the Eckert protocol cannot be performed with chocolate balls. Formally, this is due to the 
nonexistence of two-valued states in four-dimensional Hilbert space. 

Suppose one would nevertheless attempt to "mimic" the Ekert protocol with a classical "sin- 
glet" state which uses compositions of two balls of the form ^ — / ^ — / ^ — I 
with strictly different (alternatively strictly identical) particle types. The resulting proba- 
bilities and expectations would obey the classical Clauser-Horne-Shimony-Holt bounds [40]. This 
is due to the fact that generalized urn models have quasi-classical probability distributions which 
can be represented as convex combinations of the full set of separable two-valued states on their 
observables. 



C. Nonprobabilistic value indefiniteness 

In an attempt to fully utilize quantum value indefiniteness, we propose a generalization of the 
BB84 protocol on a propositional structure which does not allow any two-valued state. In princi- 
ple, this could be any kind of finite configuration of observables in three- and higher-dimensional 
Hilbert space; in particular ones which have been proposed for a proof of the Kochen-Specker 
theorem. 

For the sake of a concrete example, we shall consider the tightly interlinked collection of 
observables in four-dimensional Hilbert space presented by Cabello, Estebaranz and Garcia- 
Alcaine [41, 42], which is depicted in Figure 2. Instead of two measurement bases of two- 
dimensional Hilbert space used in the BB84 protocol, nine such bases of four-dimensional Hilbert 
space, corresponding to the nine smooth (unbroken) orthogonal curves in Fig. 2 are used. In what 
follows, it is assumed that any kind of random decision has been prepared according to the protocol 
for generating random sequences sketched above. 

(i) In the first step, "Alice" randomly picks an arbitrary basis from the nine available ones, and 
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(0,1,-1,0) (1,0,0,1) (1,1,1,-1) (-1,1,1,1) 




(0,0,1,-1) (1,-1,0,0) (1,1,-1,-1) (1,1,1,1) 

FIG. 2 Greechie orthogonality diagram of a "short" proof [41, 42] of the Kochen-Specker theorem in four 
dimensions containing 24 propositions in 24 tightly interlinked contexts [43]. The graph cannot be colored 
by the two colors red (associated with truth) and green (associated with falsity) such that every context 
contains exactly one red and three green point. For the sake of a proof, consider just the six outer lines and 
the three outer ellipses. Then in a table containing the points of the contexts as columns and the enumeration 
of contexts as rows, every red point occurs in exactly two contexts, and there should be an even number of 
red points. On the other hand, there are nine contexts involved; thus by the rules it follows that there should 
be an odd number (nine) of red points in this table (exactly one per context). 

sends a random state to "Bob." 

(ii) In the second step, Bob independently from Alice, picks another basis at random, and mea- 
sures the particle received from Alice. 

(iii) In the third step, Alice and Bob compare their bases over a public channel, and keep only 
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(0,1,0,0) 




(1,0,0,0) (0,1,1,0) (0,1,-1,0) (0,0,0,1) 



(1,0,0) (0,1,1) 



(0,1,-1) 



(a) 



(b) 



FIG. 3 Subdiagrams of Figure 2 allowing (value definite) chocolate ball realizations. 

those events which were recorded either in a common basis, or in an observable interlinking 
two different bases. 

(iv) Both then exchange some of the remaining matching outcomes over a public channel to 
assure that nobody has attended their quantum channel. 

(v) Bob and Alice encode the four outcomes by four or less different symbols. As a result, Bob 
and Alice share a common random key certified by quantum value indefiniteness. 

The advantage of this protocol resides in the fact that is does not allow its realization by any 
partition of a set, or any kind of colored chocolate balls. Because if it did, any such coloring could 
be used to generate "classical" two-valued states, which in turn may be used towards a classical 
re-interpretation of the quantum observables; an option ruled out by the Kochen-Specker theorem. 

Readers not totally convinced at this point might, for the sake of demonstration, consider a gen- 
eralized urn model with nine colors, associated with the nine bases in Figure 2. Suppose further 
that there is a uniform set of symbols, say {0, 1,2,3} for all four colors. If all varieties (permu- 
tations) contribute, the number of different types of balls should be 4^. Note, however, that every 
interlinked color must have identical (or at least unique "partner") symbols in the interlinking 
colors; a condition which cannot be satisfied "globally" for all the interlinks in Figure 2. 

A simplified version of the protocol, which is based on a subdiagram of Figure 2, contains 
only three contexts, which are closely interlinked. The structure of observables is depicted in 
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Figure 3(a). The vectors represent observables in four-dimensional Hilbert space in their usual in- 
terpretation as projectors generating the one-dimensional subspaces spanned by them. In addition 
to this quantum mechanical representation, and in contrast to the Kochen-Specker configuration 
in Figure 2, this global collection of observables still allows for value definiteness, as there are 
"enough" two valued states permitting the formation of a partition logic and thus a chocolate ball 
realization; e.g., 

{{{1,2},{3,4,5,6,7},{8,9,10,11,12},{13,14}}, 
{{1,4,5,9, 10}, {2,6,7, 11, 12},{3,8}, {13,14}}, 
{{1,2},{3,8},{4,6,9,11,13},{5,7,10,12,14}}}. 
The three partitions of the set {1,2, ... , 14} have been obtained by indexing the atoms in terms 
of all the nonvanishing two-valued states on them [18, 44], as depicted in Figure 4. They can be 
straightforwardly applied for a chocolate ball configuration with three colors (say green, red and 
blue) and four symbols (say 0, 1,2, and 3). The 14 ball types corresponding to the 14 different 

two-valued measures are as follows 

and 

Figure 3(b) contains a three-dimensional subconfiguration with two complementary contexts 
interlinked in a single observable. It again has a value definite representation in terms of partitions 
of a set, and thus again a chocolate ball realization with three symbols in two colors; e.g., 
0, and 0. 



IV. NONCOMMUTATIVE CRYPTOGRAPHY WHICH CANNOT BE REALIZED QUANTUM 
MECHANICALLY 

Quantum mechanics does not allow a "triangular" structure of observables similar to the one 
depicted in Fig. 3 with three instead of four atoms per block (context), since no geometric config- 
uration of tripods exist in three-dimensional vector space which would satisfy this scheme. (For 
a different propositional structure not satisfiable by quantum mechanics, see Specker's program- 
matic article [45] from 1960.) It contains six atoms 1, ... ,6 in the blocks 1-2-3, 3-4-5, 5-6-1. 
In order to obtain a partition logic on which the chocolate ball model can be based, the four two- 
valued states are enumerated and depicted in Figure 5. 
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2 2 2 3 




3 3 3 3 




4 4 



FIG. 4 Two-valued states interpretable as global truth functions of the observables depicted in Figure 3(a). 

Encircled numbers count the states, smaller numbers label the observables. 
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1 3 2 2 



FIG. 5 Two- valued states on triangular propositional structure with three atoms per context or block. 

The associated partition logic is given by 

{{{1},{2},{3,4}}, 
{{1,4},{2},{3}}, 
{{1},{2,4},{3}}}. 

Every one of the three partitions of the set { 1 , . . . , 4} of ball types labelled by 1 through 4 corre- 
sponds to a color; and there are three symbols per colors. For the first (second/third) partition, the 
propositions associated with these protocols are: 

• "when seen through light of the first (second/third) color (e.g., pink/light blue/yellow), sym- 
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{3} 




FIG. 6 Prepositional structure allowing (value definite) chocolate ball realizations with three atoms per 
context or block which does not allow a quantum analog. 

bol "0" means ball type number 1 (2/3);" 

• "when seen through light of the first (second/third) color (e.g., pink/light blue/yellow), sym- 
bol "1" means ball type number 3 or 4 (1 or 4/2 or 4);" 

• "when seen through light of the first (second/third) color (e.g., pink/light blue/yellow), sym- 
bol "2" means ball type number 2 (3/1)." 

More explicitly, there are four ball types of the form and The resulting 

propositional structure is depicted in Fig. 6. With respect to realizability, cryptographic proto- 
cols — such as the one sketched above — based on this structure are "stranger than quantum 
mechanical" ones. 



V. SUMMARY AND DISCUSSION 



It has been argued that value indefiniteness should be used as a quantum resource against crypt- 
analytic attacks, as complementarity may not be a sufficient resource for the type of "objective" 
security envisaged by quantum cryptography. A necessary condition for this quantum resource is 
the presence of at least three mutually exclusive outcomes. 

It may be objected that quantum complementarity suffices as resource against cryptanalytic 
attacks, and thus the original BB84 protocol needs not be amended. To this criticism I respond 
with a performance of the original BB84 protocols with chocolate balls [19]; or more formally, by 
stating that configurations with just two outcomes leave open the possibility of a quasi-classical 
explanation, as they cannot rule out the existence of sufficiently many two-valued states in order 
to construct homeomorphisms, i.e., structure-preserving maps between the quantum and classical 
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observables. Thus, when it comes to fully "harvesting" the quantum, it appears prudent to utilize 
value indefiniteness, one of its most "mind-boggling" features encountered if one assumes the 
existence of nonoperational yet counterf actual observables. 
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